Re: [Patch]Fix the error in the output of "auditctl -s" when auditd is stoped

[John Dennis <jdennis@redhat.com>]

[-- Attachment #1.1: Type: text/plain, Size: 1086 bytes --]

Eric Paris wrote:
> On Thu, 2008-08-07 at 12:50 +0800, Chu Li wrote:
>   
>> Hi Steve,
>>   When auditd is stoped, "auditctl -s" will show "pid=0". I think it's not
>> correct information. It's better to tell users "auditd not started".
>>     
>
> We do try to keep the whole key=value pair thing in audit records.  I'd
> be willing to go with something like -1 to make it really clear, but
> with the number of complaints about the inconsistencies of audit records
> from people like John Dennis I'm not sure I'm a fan of this patch....
>   
Thank you Eric! We should be moving toward consistent formatting of 
audit records and one of the most important consistencies to achieve if 
we do modify the records is that all data is in the form of key=value. 
Embedding random strings into records makes parsing difficult especially 
when the record format varies by kernel version, which this patch would 
do (at least the proposed string didn't contain any embedded spaces!)

NAK to this patch.

I think Eric's suggestion of pid=-1 is a good one.

-- 
John Dennis <jdennis@redhat.com>


[-- Attachment #1.2: Type: text/html, Size: 1639 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]